Hi all, May I confirm if WAF in Application gateway can protect from the attacks listed below? Buffer overflow SSI injection Directory Traversal I cannot find these in the document below. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=owasp32#crs800-32

Application gateway WAF can protect all attacks listed>

Testa 551

Hi all,

May I confirm if WAF in Application gateway can protect from the attacks listed below?

ChaitanyaNaykodi-MSFT 22,701 Reputation points Microsoft Employee

2022-12-01T18:36:51.913+00:00

@Testa ,

Thank you for reaching out. I have reached out to the team internally regarding this issue and will share an update as soon as I get a response. Thank you!
Testa 551 Reputation points

2022-12-06T01:04:29.067+00:00

Hi ＠ChaitanyaNaykodiMSFT-9638, Any feedback from your internal team?
Testa 551 Reputation points

2022-12-12T13:24:43.3+00:00

Hi ＠ChaitanyaNaykodiMSFT-9638, Any feedback from your internal team?
ChaitanyaNaykodi-MSFT 22,701 Reputation points Microsoft Employee

2022-12-12T21:47:54.013+00:00

@Testa ,

Apologies for the delayed response here. I got an update.

The path traversal attacks are protected by CRS 3.2 CRS rule groups and rules - Azure Web Application Firewall | Microsoft Learn.

It does not look like there are specific rules in CRS 3.2 for buffer overflow or SSI injection even though they are both part of OWASP framework. Can you please explain how you expect SSI injection and buffer overflow can occur in your specific environment?
ChaitanyaNaykodi-MSFT 22,701 Reputation points Microsoft Employee

2022-12-15T13:08:00.887+00:00

@Testa ,
Just following up here to see if you were able to take a look at my comment above. Thank you!